CVE-2026-85731
—Symlink path traversal in oras-go OCI layer extraction enables arbitrary file write
oras-go, a Go library for managing OCI artifacts, contains a path traversal flaw (CWE-22, CWE-59) in its content/file.Store code: when extracting OCI layers annotated with io.deis.oras.content.unpack=true, symlink targets are validated only lexically and writeFile follows a terminal symlink when opening a regular file, allowing a crafted archive to escape the store working directory even when AllowPathTraversalOnWrite is false. Attackers trigger it by getting a user, developer, or CI pipeline to pull an attacker-controlled artifact through the vulnerable extraction path. The result is creation or overwrite of any file writable by the pulling process, which can lead to code execution via overwriting scripts, configuration, or other executable content. Any application, CLI, or service that embeds oras-go prior to version 2.6.2 and unpacks artifacts from untrusted or compromised registries is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.
What to do: Upgrade oras-go to version 2.6.2 and rebuild any tooling that embeds it; check dependency manifests for github.com/opencontainers/oras-go to identify affected builds. Until patched, avoid pulling or unpacking OCI artifacts from untrusted registries, and on systems where such pulls run, audit for unexpected file creation or modification by the pulling process.
| ORAS project (oras-project) oras-go (Go library for OCI artifacts, content/file.Store unpack path) | prior to 2.6.2 (fixed in 2.6.2) |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
- Weakness
- CWE-22, CWE-59
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.